Entanglement Sharing Protocol via Quantum Error Correcting Codes 
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We introduce a new multiparty cryptographic protocol, which we call 'entanglement sharing 
schemes', wherein a dealer retains half of a maximally-entangled bipartite state and encodes the 
other half into a multipartite state that is distributed among multiple players. In a close ana- 
logue to quantum secret sharing, some subsets of players can recover maximal entanglement with 
the dealer whereas other subsets can recover no entanglement (though they may retain classical 
correlations with the dealer). We find a lower bound on the share size for such schemes and con- 
struct two non-trivial examples based on Shor's [[9, 1, 3]] and the [[4, 2, 2]] stabilizer code; we further 
demonstrate how other examples may be obtained from quantum error correcting codes through 
classical encryption. Finally, we demonstrate that entanglement sharing schemes can be applied to 
characterize leaked information in quantum ramp secret sharing. 

PACS numbers: 03.67. Pp,03.67.Dd, 03.67.Hk, 03.67.Mn 



I. INTRODUCTION 

Secret sharing is a well-studied multi-party crypto- 
graphic protocol in the classical regime [1|, 13 and the 
quantum regime, which can correspond to either shar- 
ing classical messages via quantum channels 0] or shar- 
ing arbitrary quantum states Q known as CQ and QQ 
versions, respectively [Bjj; we focus on QQ secret shar- 
ing here. Multi-party cryptographic protocols typically 
are described as involving one party (the dealer) possess- 
ing some information (the secret) which they distribute 
among the other parties (the players) in such a way that 
some subsets of players can completely recover the secret, 
whereas other subsets of players are denied any knowl- 
edge of the secret. Secret sharing has numerous applica- 
tions in cryptography including secure multi-party com- 
putation, effecting the Byzantine agreement, threshold 
cryptography, access control, and generalized oblivious 
transfer [fj. In the quantum regime, where the secret 
can be quantum information, quantum secret sharing 
(QSS) could be applied to quantum generalizations of 
applications for secret sharing, such as distributed quan- 
tum computation Q or authorizing one party to access 
encrypted quantum communication. 

Here we develop a theory of entanglement sharing 
schemes (ESS), which is based on QSS including one 
dealer and multiple players, but we are concerned not 
with recovery of classical or quantum information but 
rather with recovering shared entanglement between the 
dealer and the players. This secure protocol for shar- 
ing entanglement is important as entanglement is a valu- 
able communication resource when only classical or de- 
graded quantum channels are available between dealer 
and players after the initial sharing stage. Entanglement 
is a crucial consumable resource for quantum communica- 
tion tasks such as quantum teleportation , super-dense 
coding 9fl and device- independent quantum key distribu- 
tion \mJiM- 

In entanglement sharing, the dealer, rather than en- 
coding an arbitrary quantum state as in QSS, encodes 



half of a bipartite maximally-entangled state (MES), 
which is then distributed to multiple players. This dis- 
tribution meets the requirement that the entanglement 
can be perfectly recovered between the dealer and certain 
"authorized" subsets of players (the resultant shared en- 
tanglement being then usable as a resource) . Futhermore 
no entanglement can be obtained between the dealer and 
other "unauthorized" subsets of players. The "access 
structure" is the collection of all authorized subsets, and 
the "adversary structure" is the collection of all unau- 
thorized subsets. 

The ESS, QSS and quantum error correcting coding 
(QECC) are interrelated as we shall discover in this pa- 
per. Any QSS scheme can be modified to serve as an 
ESS, and all ESSs can be derived from quantum error 
correcting codes. In symbolic language we can write 
QSS. Moreover quantum ramp secret sharing protocols 
(QRSSs) contain ESSs and are contained in protocols 
corresponding to quantum error correcting codes. Sym- 
bolically we can write 

QSS c ESS c QRSS c QECC 

for the ~ symbol denoting that the indicated scheme is 
actually its adaptation to ESS. 

Entanglement sharing can be implemented using any 
QSS scheme: the dealer simply chooses the shared infor- 
mation to be half of an MES and proceeds as normal; the 
requirement for unauthorized subsets of the QSS scheme 
to have no information about the secret will ensure no 
shared entanglement with the dealer. However, as we 
find, the differing requirements for ESSs (in particular 
the ability for unauthorized subsets to share classical cor- 
relations with the dealer) allow for distinct schemes to 
be constructed. We present examples of such schemes in 
later sections, and discuss how the use of classical encryp- 
tion allows them to be constructed from error-correcting 
codes which may not naturally allow for such schemes. 

Finally we discuss the conceptual use of ESSs in 
the context of sharing arbitrary quantum states at a 
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lower cost. In QSS possessing perfect secrecy against 
information leakage, the size of shares allocated to each 
player must be at as large as the size of the secret 0, [l2| . 
This limitation on the size of shares can impose large 
communication and storage costs. QRSS is cheaper in 
the size of shares than quantum secret sharing, but it 
leaks some information to unauthorized sets of players, 
which are denoted as intermediate sets [Hj]. As the 
information leakage can compromise the secrecy of 
protocols, it is important to characterize the leaked 
information and prevent the intermediate structure from 
learning any valuable information. 



II. ENTANGLEMENT SHARING SCHEMES 

Our general form of an ESS is as follows: suppose that 
a dealer D initially prepares a quantum system in an MES 
\S). She retains half of the system, and encodes the other 
half into the n shares of players P = {Pi,P2, . . . , P n }- 
Every subset of players must be either an authorized set 
or an unauthorized set. We denote as the recoverability 
condition that any authorized set of players can recon- 
struct \S) fully using local operations (with respect to 
the player/dealer divide; they may perform joint quan- 
tum operations within their subset), and as the secrecy 
condition that any unauthorized set cannot share any 
entanglement with the dealer. 



A. Properties 

We note that in this scheme every access structure is 
monotone i.e. any set of shares including an authorized 
set is also authorized. Also the complement of any au- 
thorized set must be unauthorized, due to monogamy of 
entanglement [lil [l5j , which states that if two systems 
are maximally entangled they cannot be entangled with 
any third system. This can be expressed, for example, 
via the inequality 
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E{p xz ) < E{p x{ - YZ ^ 



(1) 



for any composite system of X , Y and Z. This inequal- 
ity holds for some entanglement measures such as the 
one-way distillable entanglement and the squashed en- 
tanglement (l6l. Il7j. 

Let X be the dealer, Y be an authorized set and Z be 
the complement of Y. As p XY can be transformed into 
pX(YZ) ky LOCC (local operations and classical commu- 
nication) with respect to the dealer/player divide, and 
vice versa, p XY must have the same amount of entangle- 
ment with respect to this divide as p x ( YZ \ Therefore, 
the complement of any authorized set is an unauthorized 
set, i.e., E(p xz ) = 0. It similarly follows that, due to 
the monogamy of entanglement, an access structure in 
an ESS cannot have two disjoint subsets, since both such 



subsets could simultaneously recover maximal entangle- 
ment with the dealer. This is analogous to quantum se- 
cret sharing not allowing an access structure to have two 
disjoint subsets due to the no-cloning theorem. 

We derive the relationship between the size of 
shares and the recoverable entanglement using the non- 
lockability of the relative entropy of entanglement [HI, [l9[ 
to obtain the following Theorem. 



Theorem 1. Every ESS satisfies 
E R (p DP ) < 2q 



(2) 



where E R is the relative entropy of entanglement, p is 
any state shared between a dealer D and a set of play- 
ers P, and q is the size of the smallest player share (i.e. 
q is the number of qubits in that share). 

Proof. Let Y be an unauthorized set satisfying r U u = A 
where u ^ T is the smallest player share and A is an au- 
thorized set, and let p° Tu be the reduced density matrix 
of joint system of A and the dealer. Assume that the 
total dephasing (i.e., twirling) is performed on the share 
u. That is, the unitary operators gf G {/, X, Y, Z}® q 
are applied to u with equal probabilities. Then relative 
entropy of entanglement En satisfies 

< S \Y^PiPi\ - ^PiS{pi) (3) 

with 

Pi = (i Dr ®. g r)p Dr "(i Dr ® ff r) (4) 

and Pi = i . Due to total dephasing, we have 



(5) 



Hence, the share u does not now contribute to the entan- 
glement with the dealer because it is independent of the 
other shares and the dealer. Thus, 



Er ^Y^PiPi] 



= E R (tv u (p ulu )) 



(0) 



As the relative entropy of entanglement is invariant 
under local unitary transformations, we also have 

J2p*Er(p>) = £j^(p Dr ") = £fl(p OTu ). (7) 

i i 

Using the above equations we can rewrite (J2J) as 
E R (p Dru yE R (tr u (p Dru )) 

< s(Y^PtPi) - ^2piS{pi) 

i i 

< H(pi) = 2q. (8) 
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As r is an unauthorized set, its reduced density ma- 
trix tr M (/5 Dr ") is not entangled with the dealer; i.e., 
E R (tT u (p Dru )) = 0. On the other hand, p° Tu has the 
same amount of entanglement as p° p because p° Tu can 
be transformed into p° p by LOCC and vice versa. There- 
fore, we have E R {p DP ) = E R (fP ru ). □ 

Any bipartite entanglement measure has the same 
value for an MES . Therefore, if a dealer D shares an 
MES with a set of players P, we have E(p° p ) = E R (p DP ). 

Let T be an unauthorized set such that A = T U r is 
authorized, where r is a one-qubit share. As the set A can 
recover the entangled state p DP initially shared between 
a dealer D and a set of players P, the state p DA has the 
same amount of entanglement as p DP , but the amount 
of entanglement must go to zero by discarding the share 
r. According to [HI, the amount of entanglement can 
decrease at most by two upon discarding one qubit with 
respect to the relative entropy of entanglement. This 
leads to the following corollary to Theorem Q] 

Corollary 2. For any entanglement measure E, 

E(p DP ) < 2q (9) 

where p DP is an initial MES and q is the size of the 
smallest share. 

We note here a distinct difference between an ESS and 
a QSS, despite the close analogies of the two processes; 
in QSS the size of the secret can be no larger than that 
of the smallest share [l2| , whereas in an ESS (for which 
we find protocols that saturate this bound) one can share 
twice as much entanglement as the size of the smallest 
share. 

Just as in QSS, a natural starting point for construct- 
ing an ESS is to use an existing QECC, as the recovery 
operation in an ESS is a form of correction of erasure er- 
rors (the missing shares of the players which are not part 
of the subset performing the recovery). Thus, a given 
QECC naturally satisfies the necessary recovery condi- 
tion for some ESS. However, the secrecy condition for an 
ESS may be violated if the code space yields unautho- 
rized sets that share partially entangled states (i.e., nei- 
ther maximally entangled nor separable) with the dealer. 

As [[n, k, d]} stabilizer codes are simple well-understood 
codes, we focus on using such codes as the basis for seek- 
ing ESSs. A dealer encodes a MES 



\Sr 



3=0 



(10) 



via the mapping 

\s 2k ) * m = -L ^ mcj 



2 k -l 



(11) 



3=0 



where the code space C of the [[n, k,d]] stabilizer code 
is spanned by {\Cj)}j=o-"2 h -i with each Cj a codeword 



of C. Each qubit of the code is taken as a share (i.e., 
C = ,ye Pl ® J£p 2 ® ■ ■ ■ ® 3V Pn where 3t? Pi is the Hilbert 
space of the i th share). 

In this scheme, an access structure is determined from 
the stabilizer S of the stabilizer code. Such a code can 
detect all errors E that are cither in S or anti-commute 
with any element of S [2(| ■ If the stabilizer code can cor- 
rect erasure errors on the set K of shares, the complement 
of -FT would be an authorized set that can reconstruct \St) 
through the recovery operation of the code. In this way 
we can determine an access structure as well as an ad- 
versary structure. 

In order to satisfy the secrecy condition of ESSs, we 
require that the reduced density matrix of every unau- 
thorized set is separable with the dealer, which will not 
automatically be the case for a given QECC. We find, for 
example, that ESSs can be constructed from Shor's nine- 
qubit code [2l| (i.e., a [[9, 1,3]] stabilizer code) and from 
a [[4,2,2]] stabilizer code [20|. In both these schemes 
the reduced density matrix of every unauthorized set is 
straightforward to write in a separable form with the 
dealer. In general determining whether or not a bipartite 
density matrix is entangled is NP-Hard [22| so verifying 
the secrecy of an ESS is typically hard. 



B. Entanglement sharing using the [[4,2,2]] code 

We now give an explicit example of an ESS. As shown 
below, the [[4,2,2]] stabilizer code leads to a threshold 
ESS (i.e., a scheme in which the access structure is de- 
termined solely by the number of players in each subset) 
due to the permutation invariance of the elements of its 
stabilizer. Moreover, this scheme saturates the bound of 
Eq. @ as the size of shares is half of the size of initial 
entanglement. 

We consider the case that a dealer D holds half of 
154) and encodes the other half into four shares P = 
{1, 2, 3, 4} according to 



1 3 

\Sa) I*> = 5 I>'>d|&>12|/?J>34 



(12) 



with 



IA>> 



|00) 



111) 



V2 
[01) + |10) 



3=0 



101 



100) - in) 

101) - |10) 



V2 • % (13) 
the set of Bell states, where D denotes the dealer's qubit 
and the index of \fi) xy refers to the x th and y th shares. 

As the stabilizer code can correct any single erasure er- 
ror, IS4) can be recovered from any three or more shares. 
Thus, any single share cannot be entangled with the 
dealer, and we can show explicitly that any single share 
is in a product state with the dealer, of the form 



(14) 
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with l x the identity matrix of a single share x. 

The subsets {1,2} and {3,4} each have a separable 
state with the dealer as is clear from Eq. (fT2|) . The fol- 
lowing analysis shows that all other sets of two shares 
are also separable with the dealer. Note that, as found 
in [HI, the indices of qubits in the state | /3j ) 12 |/3j )34 can 
be re-ordered as 

l&>12|/%>34 = Y. C 0k\Pk) Pq \Pk)rs (15) 
k 

where {p, q, r, s} is a permutation of P = {1, 2, 3, 4}. By 
tracing out two arbitrary players {p, q}, one obtains the 
separable state 

tr pg (|*)(*|) = j£(£ c jkCfk\j){j%) ®|&><ft|r- 
k 3,3' 

= \ j2Wk)(a k \-D® \Pk)(Pk\rs (16) 

fe 

where \a k ) = £\ c jk \j) D . 



C. Entanglement sharing using Shor's code 

An ESS with a general (not threshold) access structure 
can be constructed from Shor's ninc-qubit code. In this 
scheme, half of \S2) is encoded into nine shares P = 
{1, 2, 3, . . . , 9} of 1 qubit, producing the joint state of 
dealer and players of 

1 1 

l*> = -7S £ li>D|Gj) l 23|G ! i>«e|G i >789. (17) 

with 

| Go ) = _L(|000) + |111)) (18) 

and 

Id) = -^(|000) -|111)). (19) 

We note that the encoding is not fully symmetric be- 
tween shares, but divides the players into three "triplets" 
{{1,2,3},{4,5,6},{7,8,9}}. 

The nine-qubit Shor code [2l| can correct erasure er- 
rors on any of those subsets K C P which consist of 

1. any one or two qubits, 

2. two qubits in one triplet and a single qubit in an- 
other triplet (e.g., {1,2,4}), or 

3. two qubits in one triplet and two qubits in another 
triplet (e.g., {1,2,4,5}). 



Therefore, the complement of K can recover IS2) using 
error correction for the 9-qubit code, and K cannot be 
entangled with the dealer due to monogamy. 

The remaining subsets of players {-B}, consisting nei- 
ther of subsets K nor their complements, are separable 
with the dealer. For example, the reduced density matrix 
of {1, 2, 3, 4, 5, 6} can be written as 

tr 789 (|*)(*|) 
1 1 

= 2 £ U>0'Id ® IGj-XGjIxaa (8 \G 3 ){G 3 U 56 . (20) 
3=0 

In a similar way the other subsets in {B} are also 
separable with the dealer, as shown in the Appendix,, 



D. Non-perfect entanglement sharing 

As shown below, not all stabilizer codes satisfy the se- 
crecy condition for standard entanglement sharing, al- 
though we can also consider them as a "non-perfect" 
case, in which we allow some partial entanglement be- 
tween unauthorized subsets and the dealer. For example, 
a [[6,4,2]] stabilizer code [2(| yields a non-perfect ESS. 
Suppose that a dealer encodes an MES of four ebits by 
the [[6,4,2]] code such that 

1 16 16 

i £N)N)^ i £N)l/3/ W )l/3 ff w)l/3/( I ) +s(l )) (21) 

i=l i=l 

where f(i),g(i) = {0,1,2,3} and {|^-}} arc the Bell 
states. 

Any five players can recover the original entanglement 
as this stabilizer code can correct erasure errors on 
a single qubit. However, any four players have some 
entanglement with the dealer even though they are an 
unauthorized set, as can be seen in two ways. First the 
reduced density matrix of four players violates the posi- 
tive partial transpose criterion (24 . l25j . which provides 
one useful way to check state separability in ESSs when 
separability is not obvious from the density matrices. 
Second, the amount of initially shared entanglement is 
too large to satisfy Theorem [T] (i.e., Er{p° f ) = 4 and 
q = 1). Therefore, some entanglement must remain even 
after one player is excluded from an authorized set. 



III. HYBRID ENTANGLEMENT SHARING 

A QECC that does not already satisfy the secrecy 
condition can potentially be made to do so through hy- 
bridization with classical information. Similarly to hy- 
brid QSS 0, hybrid ESSs can be implemented from any 
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QECC combined with classical secret sharing, by "lock- 
ing" any leaked entanglement from recovery by first en- 
crypting the dealer's MES using classical keys (i.e., bit 
strings) and then distributing the keys among a set of 
players in such a way that unauthorized sets are totally 
denied any access to entanglement. 

The principle of encrypting quantum information with 
classical keys is shown in quantum teleportation . Al- 
ice generates two classical bits by performing a joint mea- 
surement on a quantum state |^>) that she intends to tele- 
port to Bob and half of a previously shared MES. In the 
absence of Alice's classical bits, Bob's qubit is left in a 
maximally mixed state, 

^)^\+X\^^\X + ZH')^\Z+XZ\^)(^\ZX). (22) 

However, with the knowledge of the classical bits, Bob 
can recover by determining which state of the above 
mixture his qubit is in. In a similar sense we can encrypt 
and decrypt entanglement using classical keys. 

Let us consider an MES 



V2 3=0 



(23) 



in a bipartite system of two 2 fc -dimensional Hilbert 
spaces. We can partially encrypt \E) by a unitary map- 
ping 



U l :\E)^\E l ) = -^^ ajl \a j )\b j 

Vi 3=0 



with 



an = exp 



, l £ 'Zi2 k ; 



(24) 



(25) 



randomly chosen. Note that the phase information for 
the encrypted state \E l ) is totally randomized for any 
party without knowledge of the classical key I, and thus 
the randomized state can be written in terms of separable 
states as follows: 



2"-l 



1=0 



2—1 

\ £ 6{ ] ~j l )\a 3 ){a y \®\b ] ){b y \ 



2 k 



3,3' =0 
2 fc -l 



(26) 



3=0 



Hybrid ESSs can be implemented by the following pro- 
cedure: Suppose that a dealer encodes an MES \S) into 



the code space C = span{Cj} J=0 ...2fc-i of a QECC and 
thereby obtains 



I*) 



2"-l 



c, 



(27) 



3=0 



The access structure Q for the corresponding ESS is de- 
termined by the code's ability to recover from erasure er- 
rors (for example an [[n, k, d]] stabilizer code corresponds 
to an access structure Q consisting of any n— d+1 or more 
shares). The dealer additionally performs the following 
steps: 

1. Performs U l on |\&) using a randomly chosen clas- 
sical key I. 

2. Encodes I in classical shares and distributes using a 
classical secret sharing scheme with an access struc- 
ture Q' C Q. 

We thus have a scheme with both classical and quantum 
shares, which are separately distributed among the 
n players. If a set of players is an element of Q' , it 
can recover \S) with the classical key I. Otherwise 
they are left in a separable state with a dealer be- 
cause they cannot acquire any information about I. 
We note that suitable classical secret sharing schemes 
can be easily devised by using polynomial functions [HQ]. 



IV. DESCRIBING PARTIAL INFORMATION IN 

QRSS 

As described earlier, we can consider both the "per- 
fect" ESS where unauthorized sets are denied all entan- 
glement and the "imperfect" case where this secrecy con- 
dition is relaxed and some entanglement is leaked. A sim- 
ilar framework applies to leaked information in imperfect 
QSS, known as quantum ramp secret sharing (QRSS). 
In QRSS, one considers three types of player structures: 
access, forbidden and intermediate structures. The for- 
bidden structure is the collection of unauthorized sets 
that are completely denied any information about the 
secret, and the intermediate structure is the collection of 
unauthorized sets that obtain some information about a 
secret. 

As QRSS allows for smaller player shares than perfect 
QSS, this information leakage could be an acceptable sac- 
rifice, but, for a given secret sharing scenario, what con- 
stitutes acceptable leakage likely depends on the nature 
of the information that is accessible to the intermediate 
subsets. One method to characterize information leakage 
requires stabilizer encoding and therefore requires precise 
details of encoding operation (e.g., stabilizers) to gener- 
ate the information group [26[ so is not of direct use here. 

Entanglement sharing gives us an alternative way to 
characterise this information, which may be useful in 
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many circumstances. In a perfect ESS, we can simi- 
larly consider three structures of players with respect to 
correlations with the dealer, by dividing the adversary 
structure into a forbidden structure and an intermediate 
structure. Whereas all members of the adversary struc- 
ture recover no entanglement with the dealer, we can 
distinguish between forbidden subsets (who can recover 
only product states with the dealer) and intermediate 
subsets, who can recover non-product mixed states with 
the dealer; i.e., they and the dealer can share classical 
correlations (but no entanglement). Thus player subsets 
can be divided into those recovering "quantum correla- 
tions" (entanglement), classical correlations, or no corre- 
lations with the dealer. This can be a useful qualitative 
description of leaked information. 

One can characterise the qualitative difference by con- 
sidering, for example, a circuit implementing quantum 
teleportation Q, which outputs a density matrix associ- 
ated with an input state. Given an MES as a resource, 
this circuit can be successfully operated and thus the out- 
put density matrix is identical to the input state. How- 
ever, if a product state is instead used as the resource, the 
circuit outputs the identity matrix. If a separable state 
is used as a resource, quantum teleportation cannot be 
perfectly achieved but will output a density matrix with 
some correlation with the input state. 

For example, suppose that an arbitrary quantum state 
10s) = ct\0) + (3\1) is the input state of the quantum 
teleportation circuit, and a separable state 

1(|0)(0|®|0)(0| + |1)(1|®|1)(1|) (28) 

is used as its resource. Then the circuit outputs 

^ = M 2 |0)(0| + |/?| 2 |1)(1|. (29) 

The output density matrix of this "classical teleporta- 
tion" contains some information about the diagonal el- 
ements of the density matrix ps — \4>s){4>s\ but noth- 
ing about its off-diagonal elements. In this context we 
can characterize leaked information about the secret in a 
QRSS scheme as "quantum" or "classical" in the sense of 
requiring a quantum or only a classical channel to trans- 
mit. 

By considering QRSS schemes as ESSs (applying the 
scheme to a secret of half of an MES, with the other 
half retained by the dealer), we therefore have a means 
of characterizing this information: a unauthorized sub- 
set of players who can recover a partially-entangled state 
with the dealer have some leaked quantum information, 
whereas those recovering a separable state only have 
leaked classical information. This method of classifying 
information in the context of quantum teleportation pro- 
vides one unambiguous definition of leakage of specifi- 
cally quantum information, as it relies only on the clear 
definitions of entangled and separable states. Since quan- 
tum correlations are useful resources in many contexts, 
a QRSS scheme may be acceptable if, for example, the 
only information leaked is classical. 



Now let us revisit the [[4,2,2]] stabilizer code. The 
[[4, 2, 2]] stabilizer code is not only used to devise an ESS 
but also for a (3, 2, 4) QRSS scheme H (where (3, 2, 4) 
denotes a four-player scheme in which 3-player subsets 
are authorized, whereas 3 — 2 = 1 player subsets receive 
no information about the secret, and two-player subsets 
receive partial information). Suppose that the ESS using 
the [[4, 2, 2]] stabilizer code is applied to supply an MES 
required for quantum teleportation. If an arbitrary quan- 
tum state py> is transmitted to four players, any three or 
more players can receive the state perfectly with the re- 
covered MES, and any single player can acquire no infor- 
mation. However, any two players can have a separable 
state with the dealer and learn the information about di- 
agonal elements of /?d- Therefore, the [[4,2,2]] stabilizer 
code yields a QRSS scheme that leaks only classical in- 
formation to unauthorized sets, which corresponds to the 
result of [1^. 

Formally, we propose a secrecy condition for QRSS in 
terms of entanglement sharing as follows. 

Definition 1. Given an encoding operation C : — > 
Jifp mapping 

(1 D ®C) :\S) = -±=^2\j) D \j) D ^ 
VIM , 

(30) 

a QRSS scheme described by C is secure from the leakage 
of quantum information if the reduced density matrix for 
every intermediate set V G P, 

/ = mi*x*i), 

is separable with the system D for Y the complement ofT . 

V. CONCLUSIONS 

We have introduced a new protocol for entanglement 
sharing, which allows a dealer to distribute half of a MES 
with a set of players in such a way that some collaborat- 
ing groups of players can recover the entangled state fully, 
but other groups cannot share any entanglement with the 
dealer. While closely related to QSS (every perfect QSS 
scheme will also be an entanglement sharing scheme) the 
entanglement sharing conditions result in different prop- 
erties for these schemes (for example share size of each 
player need only be at least half the amount of initial 
entanglement). We have demonstrated examples of con- 
struction of entanglement sharing schemes from stabilizer 
codes, both directly and through hybridization with clas- 
sical encryption. We note that the general relationship 
between QECCs and entanglement sharing (i.e., whether 
or not schemes can be directly constructed from a given 
QECC) is still not evident, and therefore is a promising 
avenue for further investigation. 
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Finally, we have shown that the entanglement shar- 
ing paradigm provides a useful characterization of infor- 
mation leakage in QRSS schemes, wherein any QECC 
suitable for perfect entanglement sharing can be used to 
construct a QRSS in which only classical information is 
leaked to unauthorized player subsets. Given the many 
contexts in which entanglement is a crucial resource for 
performing quantum information protocols, this charac- 
terization, and entanglement sharing schemes in general, 
have the potential for a wide range of applications. 
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Appendix: Investigation of Shor's code 

In this appendix, we supplement Sec. Ill CI by investi- 
gating other sets in {B}. As {1, 2, 3, 4, 5, 6} is in a separa- 
ble state with a dealer, {1, 2, 3, 7, 8, 9} and {4, 5, 6, 7, 8, 9} 
are also separable with the dealer as shown by per- 
mutation of the triplets. Similarly the complement of 
{1, 2, 3, 4, 5, 6}, namely {7, 8, 9}, is in a separable state 

1 1 

2 5>'>0'|d ^G^U (A.l) 
j=o 

and thus {1, 2, 3} and {4, 5, 6} are also separable with the 
dealer. We regard these six subsets as a class of {1, 2, 3}. 

Every set in {B} is classified into four classes: {1, 2, 3}, 
{1,4,7}, {1,2,3,4} and {1,4,7,8}. For each class, it 
is enough to demonstrate whether or not the reduced 
density matrices of a small subset (e.g., {1,2,3}) and a 
big subset (e.g., {1,2,3,4,5,6}) are separable with the 
dealer. 



Let us look at the class of {1,4, 7}. The complement 
of {1, 4, 7} has a separable state written as 

- (|+)(+| D ® P235689 + |-)(-|D <8 P23568!)) (A.2) 

with 

|±) D :=-L(|0) D ±|l) D ), 

P235689 =-(|000000) (000000| + |001111)(001111| 

+ |110011)(110011| + |111100)(111100|), 

P235689 = jflOOOOll) (000011| + 1001100) (0011001 

+ 1 110000) (1100001 + |111111)(111111|). 

(A.3) 

If we discard three more qubits {2, 5, 8} from the state 
in Eq. (|A.2I) . the resulting density matrix is a reduced 
density matrix of {3,6,9} in this class and still has a 
separable form with the dealer. 

Next we consider the class of {1,2,3,4}. The re- 
duced density matrix for {5,6,7,8,9} (the complement 
of {1, 2, 3, 4}) is given by 

789 

3=0 

<8> ^ (|00><00|5e + |ll><ll|5a). (A.4) 

In this case, the subset {5, 6} is independent of the other 
qubits so the reduced density matrix for {6, 7, 8, 9} (a 
small set in the class of {1, 2, 3, 4}) is separable with the 
dealer after tracing out player 5. 

Finally we consider the class of {1, 4, 7, 8}. By tracing 
out {8} and {5,8} from the state of Eq. (|A.2|) . clearly 
{2,3,5,6,9} and {2,3,6,9} in this class are separable 
with the dealer. We therefore conclude that any subset 
of players in {B} is in a separable state with the dealer. 
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